xtts

SUSPICIOUS. The main XTTS behavior is mostly coherent: it collects a Pixazo API key, stores it locally, and sends TTS requests to a Pixazo-operated gateway documented for this model. The main concerns are proportionality and data-flow trust: the skill routes credentials and content through a third-party gateway rather than the underlying Coqui service, reads/writes a raw local credential file, and includes an unrelated transitive skill-install instruction. Not enough evidence for malware, but the intermediary routing and skill-to-skill install path make it higher risk than a narrowly scoped direct API integration.